ApiQueryTokens.php

Go to the documentation of this file.

<?php
namespace MediaWiki\Api;
 
use MediaWiki\MediaWikiServices;
use MediaWiki\User\User;
use Wikimedia\ParamValidator\ParamValidator;
 
class ApiQueryTokens extends ApiQueryBase {
 
    public function execute() {
        $params = $this->extractRequestParams();
 
        if ( $this->lacksSameOriginSecurity() ) {
            $this->addWarning( [ 'apiwarn-tokens-origin' ] );
            return;
        }
 
        $user = $this->getUser();
        $session = $this->getRequest()->getSession();
        $salts = self::getTokenTypeSalts();
 
        $done = [];
        $path = [ 'query', $this->getModuleName() ];
        $this->getResult()->addArrayType( $path, 'assoc' );
 
        foreach ( $params['type'] as $type ) {
            $token = self::getToken( $user, $session, $salts[$type] )->toString();
            $fit = $this->getResult()->addValue( $path, $type . 'token', $token );
 
            if ( !$fit ) {
                // Abuse type as a query-continue parameter and set it to all unprocessed types
                $this->setContinueEnumParameter( 'type',
                    array_diff( $params['type'], $done ) );
                break;
            }
            $done[] = $type;
        }
    }
 
    public static function getTokenTypeSalts() {
        static $salts = null;
        if ( !$salts ) {
            $salts = [
                'csrf' => '',
                'watch' => 'watch',
                'patrol' => 'patrol',
                'rollback' => 'rollback',
                'userrights' => 'userrights',
                'login' => [ '', 'login' ],
                'createaccount' => [ '', 'createaccount' ],
            ];
            $hookContainer = MediaWikiServices::getInstance()->getHookContainer();
            $hookRunner = new ApiHookRunner( $hookContainer );
            $hookRunner->onApiQueryTokensRegisterTypes( $salts );
            ksort( $salts );
        }
 
        return $salts;
    }
 
    public static function getToken( User $user, \MediaWiki\Session\Session $session, $salt ) {
        if ( is_array( $salt ) ) {
            $session->persist();
            return $session->getToken( ...$salt );
        } else {
            return $user->getEditTokenObject( $salt, $session->getRequest() );
        }
    }
 
    public function getAllowedParams() {
        return [
            'type' => [
                ParamValidator::PARAM_DEFAULT => 'csrf',
                ParamValidator::PARAM_ISMULTI => true,
                ParamValidator::PARAM_TYPE => array_keys( self::getTokenTypeSalts() ),
                ParamValidator::PARAM_ALL => true,
            ],
        ];
    }
 
    protected function getExamplesMessages() {
        return [
            'action=query&meta=tokens'
                => 'apihelp-query+tokens-example-simple',
            'action=query&meta=tokens&type=watch|patrol'
                => 'apihelp-query+tokens-example-types',
        ];
    }
 
    public function isReadMode() {
        // So login tokens can be fetched on private wikis
        return false;
    }
 
    public function getHelpUrls() {
        return 'https://www.mediawiki.org/wiki/Special:MyLanguage/API:Tokens';
    }
}
 
class_alias( ApiQueryTokens::class, 'ApiQueryTokens' );